CVE Catalog
CVE-2016-4010
CriticalSummary
Magento CE and EE before 2.0.6 allows remote attackers to conduct PHP objection injection attacks and execute arbitrary PHP code via crafted serialized shopping cart data.
Risk Assessment
Attackers can exploit this vulnerability to execute code remotely, potentially leading to system compromise and data leakage.
Recommendation
It is recommended to update Magento to version 2.0.6 or later to mitigate these attacks.
Original NVD description (English source)
Magento CE and EE before 2.0.6 allows remote attackers to conduct PHP objection injection attacks and execute arbitrary PHP code via crafted serialized shopping cart data.